CVE-2026-14828
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
Risk Assessment
The risk is high because an authenticated attacker can exploit the vulnerability to manipulate the database, potentially leading to unauthorized access to sensitive data, including passwords.
Recommendation
Immediately update all affected products to patched versions. Also restrict user privileges and monitor SQL queries.
Other vulnerabilities in ManageEngine Password Manager Pro
See all- CVE-2016-1161High
CVE-2016-1161 is a Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before version 8.5 (Build 8500).
- CVE-2026-12263High
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
- CVE-2026-11840High
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
Original NVD description (English source)
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS